Posting code didn’t format as well as hoped. Download the below script here.

</Update>

For those of you who are SharePoint admins or developers but have never dug into the SharePoint API or PowerShell, I would recommend first checking out some tutorials on both and referencing the SharePoint Developer Center. At a later date I hope to be able to provide some quick demo scripts that highlight the power, time savings, and overall usefulness that can be gained by combining PowerShell and the SharePoint API. For now though I wish to post a script I developed almost a year ago as a side project to combine a number of powerful features into one script. To start, let me overview what the below script is capable of.

Recursively crawl a site or entire web application within SharePoint

Enumerate permissions assigned to a SharePoint site

Detail the SharePoint users assigned to a SharePoint group

Determine if an Active Directory group is a member of a SharePoint group

Detail the Active Directory users who are members of an Active Directory group

Search for a specific user’s permissions on a SharePoint site

Before anyone says anything, yes I realize that combining so many utilities into one script is probably a bad design and I should’ve broken out functionality. Yes this is probably true, but I want to state that this script was never intended for Production release. Instead I was prototyping what was possible with PowerShell and I even surprised myself with what I ended up with. Here is an attempt to visualize what the above hierarchy would look like.

--Site

------SharePoint User A

------SharePoint Group A

------------SharePoint User B

------------Active Directory Group A

------------------Active Directory User A

------------------Active Directory User B

As you can see, this allows you to dig much further than what you might normally surface from the SharePoint API. The true purpose of this script was to determine if a user was assigned permissions anywhere within a web application, even if indirectly by membership in a SharePoint group or Active Directory group. This was only ever intended for a test environment, so you may still find some bugs when running against your own environment.

Before running this, ensure that you have loaded the SharePoint assembly with the following call (typically placed into your PowerShell profile for ease of use):

Please leave me feedback if you end up trying out this script or have any questions on how/why I wrote things the way I did. I always enjoy constructive criticism and dialog. If you do re-post this anywhere, be sure to include the reference to the source material for the Active Directory call portion as I borrowed it from the PowerShell Script Center.

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

I am fresher about MOSS 2007.

I want to know -the users contained in all SP groups on Sharepoint site and Which users have elevated access.so is this script helpfull for me?and of yes then how i can execute this script in my MOSS env and check output.Please let me know.
5/7/2010 1:25 AM | Amey

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Amey,

For looping through all SP groups on a SharePoint site you can enumerate through the SPWeb.SiteGroups property. You can then list out all members of the group (whether user or AD group) using snippets from my above code. This code is also compatible with MOSS. To check the output run your script against a small site with just a few users in a group and compare against the listings on the actual SharePoint site settings UI. Let me know if you have further questions.
5/10/2010 7:58 PM | Brian Jackett

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Brian,

Thanks Brian.I can run this script, and get the users and there elevated access. really good script.
5/14/2010 1:55 AM | Amey

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Amey,

Glad you're able to run it and found it useful. I usually demo this script for many of my PowerShell presentations to show people the power of combining PowerShell with other components like Active Directory and SharePoint all in one script.
5/14/2010 7:09 AM | Brian Jackett

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Hi Brian,

Thanks for the post. I have an issue which i thought your script may help to resolve.

We have a Web App that contains many site collections & Sites none of which are anonymous access. The 'NT Authority\Authorised Users' group is added to all of the site collections somehow. This has the unfortunate effect of enabling the search to bring back results from other site collections. This is a really bad thing for us!

I was hoping to adapt your script to pick out the 'NT Authority\Authorised Users' and remove it from every site collection but it doesn't show up in the results..

Any ideas?I know this probably isn't fixing the root cause but I need a quick fix to buy me some time

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Michael,

I tested out your scenario by adding "NT Authority\Authenticated Users" to a site. I then ran the script and I got a result for that group. It appears as "<Group>NT AUTHORITY\authenticated users</Group>". Are you sure that isn't in your result set?
8/22/2010 5:18 PM | Brian Jackett

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Great script! I removed the ToUpper calls to get the specific user parmeter to work for me, but once I figured that out, it was very helpful. Thanks!
8/31/2010 12:50 PM | Tom Resing

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Hi Brain / All,

we are in middle to fade-out one legacy NT4.0 domain and during decommission we found that many permissions inside sharepoint are tied with this legacy domain.

Since i am not a programing guy, i would like to check with you that is your script can translate the permissions from domain-A to domain-B?

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Kushneev,

As far as I know, when you run this script you will need to be logged in as a user who has access to the target domain. If you have configured a trust between the two domains it may be possible for to enumerate accounts from both domains.

In terms of translating permissions, do you mean transfering permissions from domainA\user to domainB\user? I believe the "STSADM -o migrateuser" command may be of use to you. Try the below link for more information. Let me know if you have additional questions relating to that.

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

A truly amazing script

I had built a less comprehensive one for a client to allow them to scan sites and remove full control permissions from each of the owner groups.

One thing I wanted to mention is with the aid of the PowerGui object tree. I picked out my web groups with"SPWeb.get_Groups().Web.Groups"

Thereafter I can pick out members or owning group. I think your approach is better tho.2/14/2011 9:12 AM | Daniel Westerdale

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Daniel,

Thanks for the tip. From the looks of your snippet that looks redundant getting the web, then groups, then web and groups again. I'm not familiar enough with PowerGUI though. Been meaning to take a look at it more. Glad you found my script useful.2/14/2011 1:45 PM | Brian T. Jackett

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Hi Great script - thanks!

When i run it using .\DisplaySPWebApp6.ps1 http://server >userpermissions.txt

Please can you advise on how to overcome this?
5/23/2011 8:26 AM | Tomas Andrews

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Tomas,

I'm not sure why you are receiving an exception on the "-ne" operator. Do you receive an exception when using that operator by itself in a simple command?

Also just to make sure, you are running the command against a valid URL in your farm, correct? And the account you are running the script with has access to that URL?5/23/2011 8:11 PM | Brian T. Jackett

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Interestingly that error does not appear for all sites.Must be site-specific then..6/9/2011 8:32 AM | kwentine

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Hi BrianGreat script!

A question: Would it be possible to disable unnecessary functions. We just wanna run function 6: "Search for a specific user’s permissions on a SharePoint site", where we provide WebApp URL and a user name as parameters.Thanks!

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Manuel,

Thanks, glad you like the script. Yes it is possible to comment out calls to unnecessary functions. Feel free to modify the script as you see fit. I don't currently have time to help you out, but let me know if you have any questions or issues in modifying it.6/26/2011 11:56 PM | Brian T. Jackett

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

this script is awesome just what i was looking forThanks
6/29/2012 4:47 PM | Alfonso Rodriguez

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Didnt know it existed as Id given up (a few weeks ago) actually lookin for the script. Its just what the doc ordered Thanks for the effort (& results in this case :)

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Hello,

I am running .\SP_Display-SiteCollectionAdmins1.ps1 http://teams.ad/desktop >> desktop.txt but the file remains empty and the display on the screen is showing all sites and sub-sites but "site - " no account, no group are listed ???What did I mis?Thnaks,DOm12/26/2012 3:28 PM | dominique

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Hello,By comparison the command .\SP_Display-WebApp6.ps1 http://teams.ad >> desktop.txt is filling the file with data with the hierarchy which is really excellent

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Hello,the enumeration of the sites and users associated with is excellent, anyway to add the rights, privileges they have on the site..?Thanks,Dom
12/26/2012 4:52 PM | dominique

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Great script! By any chance, is there a corresponding script to create the groups and members enumerated by this script? We are in a situation of progressing through system integration testing, user acceptance testing, etc, and we are regularly recreating site collections to have a fresh test bed. It would be great to have a script to reapply the permissions each time we create a new site collection.
1/5/2013 9:24 AM | Dean

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Dominique,

This script is a couple years old and I haven't updated since I wrote it. You could add additional code to check which permissions they have, but I would likely rewrite this at this point to be more concise and use better scripting practices. For now I don't have the spare time to undertake that effort. You may want to check CodePlex for a solution or look to a 3rd party application.

Dean,

No I do not have any script to create the corresponding groups enumerated. You may want to look into SP Copy Group (http://spcopygroup.codeplex.com/) or doing a site collection backup (after configuring the groups and permissions you want) and restore. Hope that helps.1/10/2013 10:17 PM | Brian T. Jackett

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Nice job on the script. I get a complete listing of sites with who has access. I'd like to also see what permission is assigned to each group or user. Can this detail be pulled too? How? Thanks!
2/7/2013 2:26 PM | HarleyRider

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

HarleyRider,

Yes it is possible to get which permissions the user / group has been assigned. Unfortunately this script was targetted to SharePoint 2007. Since that time the SPWeb.Permissions property has been deprecated. You would be better to grab the SPWeb.RoleDefinitions instead to identify permissions assigned. I have not updated this script in years but if I do I'll post a link on here.2/16/2013 5:20 PM | Brian T. Jackett

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Great script! I'm curious if there is a way to get the AD groups that show with a SID only to do a translate into the Security Principal Name instead?

We have a resource forest and it shows the sid for groups in the alternate forest.

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory

Chris,

I've never tried this script with a different AD forest, only a single domain. It might be that the lookup that I'm doing via ADSI is limited to a single forest since.

On a semi-related note I am preparing to publish the 2010 / 2013 version of this script on my blog with some improvements and bug fixes. If you'd like to test that out send me an email (contact link up top) and see if we can work out the SID only issue.6/28/2013 4:40 PM | Brian T. Jackett

#re: The Power of PowerShell and SharePoint: Enumerating SharePoint Permissions and Active Directory